CVE-2026-98741

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ua101: reject mismatched capture/playback packet sizes

detect_usb_format() cross-checks bSubframeSize, bBitResolution and

tSamFreq between the capture and playback interfaces, but never relates

the two endpoints' wMaxPacketSize and bNrChannels. Each playback URB

gets a buffer of ua->playback.max_packet_bytes, while the number of

bytes written into it is derived from the capture stream:

capture_urb_complete() computes frames from the received capture packet

and capture.frame_bytes, and start_usb_playback() and playback_work()

multiply that by playback.frame_bytes.

A device declaring a large capture wMaxPacketSize with few capture

channels and a small playback wMaxPacketSize with many playback channels

therefore memset()s and memcpy()s past the end of the playback buffer,

in open() of the PCM node the driver registers during probe.

usb_submit_urb() rejects the over-long iso_frame_desc[0].length with

-EMSGSIZE,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References